Skip to content

Instantly share code, notes, and snippets.

@scriptingstudio
Last active December 26, 2025 15:26
Show Gist options
  • Select an option

  • Save scriptingstudio/3ab0d1a37a00de2592106ffb1d96eef8 to your computer and use it in GitHub Desktop.

Select an option

Save scriptingstudio/3ab0d1a37a00de2592106ffb1d96eef8 to your computer and use it in GitHub Desktop.
Simple Windows Event Log Converter
function Get-EventLogInfo {
[cmdletbinding()]
param ([Parameter(Position=0,Mandatory,ValueFromPipeline)]$eventobject, [switch]$text)
process {
foreach ($item in $eventobject) {
$eventData = [ordered]@{
ID = $item.Id
TimeCreated = $item.TimeCreated
Version = $item.Version
Level = $item.Level
Task = $item.Task
Opcode = $item.Opcode
Keywords = $item.KeywordsDisplayNames
LevelDisplayName = $item.LevelDisplayName
OpcodeDisplayName = $item.OpcodeDisplayName
TaskDisplayName = $item.TaskDisplayName
ContainerLog = $item.ContainerLog
RecordId = $item.RecordId
LogName = $item.LogName
ComputerName = $item.MachineName
ProcessId = $item.ProcessId
}
([xml]$item.toxml()).event.eventData.data.foreach{if ($_.Name) {$eventData[$_.Name] = $_.'#text'}}
if ($text) {$eventData['Message'] = $item.Message}
[pscustomobject]$eventData
}
}
} # END Get-EventLogInfo
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment